Send SMS Using PHP in India

<?php
// send-sms.php: run with  SMS_API_KEY=xxxx php send-sms.php
$apiKey = getenv('SMS_API_KEY');

$payload = [
    'sender_id' => 'AVNZON',
    'recipient' => '919876543210',           // 91 + 10-digit mobile
    'message'   => 'Your OTP for login is 482913. It is valid for 10 minutes. Do not share it with anyone. -AVNZON',
    'route'     => 'transactional',
];

$ch = curl_init('https://whitelabled.securesmsc.com/api/v2/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 5,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
        'Content-Type: application/json',
        'Accept: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($payload),
]);

$body   = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error  = curl_error($ch);
curl_close($ch);

if ($body === false) {
    exit("Network error: $error\n");
}
echo "HTTP $status\n";
print_r(json_decode($body, true));

{
  "success": true,
  "message": "SMS queued successfully",
  "data": {
    "message_id": 1849302,
    "queue_id": 1849302,
    "status": "queued",
    "estimated_delivery": "2026-10-29T10:42:05.000000Z"
  }
}

<?php
final class SmsClient
{
    public function __construct(
        private string $apiKey,
        private string $baseUrl = 'https://whitelabled.securesmsc.com/api/v2',
        private int $maxAttempts = 3
    ) {}

    /** Send one SMS. Returns the decoded JSON; throws on non-retryable failure. */
    public function send(string $to, string $message, string $senderId, array $extra = []): array
    {
        $payload = array_merge([
            'sender_id' => $senderId,
            'recipient' => $to,
            'message'   => $message,
        ], $extra);   // e.g. ['route' => 'promotional', 'dlt_template_id' => '1107...', 'unicode' => true]

        return $this->request('POST', '/sms/send', $payload);
    }

    public function status(string $messageId): array
    {
        return $this->request('GET', '/sms/status/' . rawurlencode($messageId));
    }

    private function request(string $method, string $path, ?array $payload = null): array
    {
        for ($attempt = 1; ; $attempt++) {
            $ch = curl_init($this->baseUrl . $path);
            $opts = [
                CURLOPT_CUSTOMREQUEST  => $method,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_CONNECTTIMEOUT => 5,
                CURLOPT_TIMEOUT        => 15,
                CURLOPT_HTTPHEADER     => [
                    'Authorization: Bearer ' . $this->apiKey,
                    'Content-Type: application/json',
                    'Accept: application/json',
                ],
            ];
            if ($payload !== null) {
                $opts[CURLOPT_POSTFIELDS] = json_encode($payload);
            }
            curl_setopt_array($ch, $opts);

            $body  = curl_exec($ch);
            $http  = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            $errno = curl_errno($ch);
            curl_close($ch);

            // Could not even connect: the request never left, safe to retry.
            $connectFailed = in_array($errno, [CURLE_COULDNT_RESOLVE_HOST, CURLE_COULDNT_CONNECT], true);
            // 429/502/503 mean "not processed, try again". A 500 or 504 on a send
            // may arrive after the message was queued, so only GETs retry those.
            $retryable = $connectFailed
                || in_array($http, [429, 502, 503], true)
                || ($method === 'GET' && $http >= 500);

            if (!$retryable || $attempt >= $this->maxAttempts) {
                $data = is_string($body) ? json_decode($body, true) : null;
                if ($http >= 200 && $http < 300 && is_array($data)) {
                    return $data;
                }
                $reason = $data['message'] ?? ($errno ? curl_strerror($errno) : "HTTP $http");
                throw new RuntimeException("SMS API error: $reason", $http);
            }
            usleep((2 ** $attempt) * 250000);   // 0.5s, 1s, 2s ...
        }
    }
}

// Usage
$sms = new SmsClient(getenv('SMS_API_KEY'));
$res = $sms->send('919876543210',
    'Your order #A1023 has been shipped and will reach you by 31 Oct. -AVNZON',
    'AVNZON');
echo $res['data']['message_id'];

Your order {#alphanumeric#} has been shipped. Track it here: {#url#} -AVNZON

<?php
const TPL_SHIPPED = 'Your order {#alphanumeric#} has been shipped. Track it here: {#url#} -AVNZON';

// Typical limits per tag (Airtel names; Vi/BSNL use {#num#}, {#alp#}, {#urg#} ...).
// Confirm against your operator's portal.
const DLT_TAG_MAX     = ['url' => 120, 'urlott' => 120, 'urg' => 120, 'uro' => 120, 'var' => 30];
const DLT_DEFAULT_MAX = 40;

function fill_template(string $template, array $values): string
{
    $i = 0;
    $out = preg_replace_callback('/\{#(\w+)#\}/', function (array $m) use (&$i, $values) {
        if (!array_key_exists($i, $values)) {
            throw new InvalidArgumentException('Not enough values for template');
        }
        $value = (string) $values[$i++];
        $max   = DLT_TAG_MAX[$m[1]] ?? DLT_DEFAULT_MAX;
        if (mb_strlen($value) > $max) {
            // Never truncate: a cut-off link or amount is worse than a failed send.
            throw new LengthException("Value for {#{$m[1]}#} is longer than $max characters");
        }
        return $value;
    }, $template);

    if ($i !== count($values)) {
        throw new InvalidArgumentException('Too many values for template');
    }
    return $out;
}

$message = fill_template(TPL_SHIPPED, ['A1023', 'https://avz.in/t/9KX2']);

$sms->send('919876543210', $message, 'AVNZON', [
    'dlt_template_id' => '1107161234567890123',   // from your DLT portal
]);

<?php
/** Returns ['encoding' => 'GSM-7'|'UCS-2', 'length' => int, 'parts' => int]. */
function sms_parts(string $text): array
{
    $basic = '@£$¥èéùìòÇØøÅåΔ_ΦΓΛΩΠΨΣΘΞÆæßÉ !"#¤%&\'()*+,-./0123456789:;<=>?¡'
           . 'ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑܧ¿abcdefghijklmnopqrstuvwxyzäöñüà' . "\n\r";
    $extended = '^{}\\[~]|€' . "\f";   // these cost 2 characters each in GSM-7

    $length = 0;
    foreach (mb_str_split($text) as $ch) {
        if (mb_strpos($basic, $ch) !== false)        { $length += 1; continue; }
        if (mb_strpos($extended, $ch) !== false)     { $length += 2; continue; }

        // Anything else forces UCS-2: count UTF-16 code units (emoji = 2).
        $units = intdiv(strlen(mb_convert_encoding($text, 'UTF-16BE', 'UTF-8')), 2);
        return ['encoding' => 'UCS-2', 'length' => $units,
                'parts' => $units <= 70 ? 1 : (int) ceil($units / 67)];
    }
    return ['encoding' => 'GSM-7', 'length' => $length,
            'parts' => $length <= 160 ? 1 : (int) ceil($length / 153)];
}

print_r(sms_parts('உங்கள் OTP 482913. 10 நிமிடங்கள் செல்லுபடியாகும். -AVNZON'));
// [encoding] => UCS-2  [length] => 57  [parts] => 1

<?php
$numbers = array_unique($numbersFromDatabase);           // de-duplicate first
$message = 'Our Sulur showroom is open this Sunday, 10 AM to 6 PM. -AVNZON';

foreach (array_chunk($numbers, 1000) as $batch) {
    $ch = curl_init('https://whitelabled.securesmsc.com/api/v2/sms/send-bulk');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('SMS_API_KEY'),
                                   'Content-Type: application/json',
                                   'Accept: application/json'],
        CURLOPT_POSTFIELDS     => json_encode([
            'sender_id'  => 'AVNZON',
            'recipients' => array_values($batch),
            'message'    => $message,
        ]),
    ]);
    $result = json_decode(curl_exec($ch), true);
    curl_close($ch);
    // log $result per batch so a failed chunk can be re-sent on its own
}

<?php
$status = $sms->status('1849302');
echo $status['data']['status'];      // queued | sent | delivered | failed

<?php
// 1. Rate-limit BEFORE generating anything (per phone and per IP).
if (otp_requests_last_hour($phone) >= 5) {
    http_response_code(429);
    exit('Too many requests. Try again later.');
}

// 2. Unpredictable 6-digit code; store only a hash, with an expiry.
$otp = str_pad((string) random_int(0, 999999), 6, '0', STR_PAD_LEFT);
save_otp($phone, password_hash($otp, PASSWORD_DEFAULT), time() + 600);

// 3. Send on the transactional route with the approved OTP template.
$sms->send($phone,
    "Your OTP for login is {$otp}. It is valid for 10 minutes. Do not share it with anyone. -AVNZON",
    'AVNZON');

// 4. On verify: check expiry, password_verify(), cap attempts at 5, then delete the row.